On 30 September 2026, France's national cybersecurity agency (ANSSI) published the results of its call for expressions of interest "Security of cybersecurity ecosystems" (AMI SEC). Out of 15 applications received, 8 projects were selected, for a total budget of EUR 1.44 million (source: ANSSI, AMI SEC results, 30 September 2026). Among them, four new CSIRT-type structures are being set up in sectors that had no dedicated sector contact point until now. For NIS2 entities in these sectors, this change is not cosmetic.
What the AMI SEC produced
The programme aimed to fund the creation or strengthening of cybersecurity support structures organised by business sector. The four new entities created are: CSIRT OPEN for digital infrastructure (led by AOTA), CERT Chimie for the chemical industry (led by the Lyon Chamber of Commerce and Industry), CSIRT Énergie-Électricité for the energy sector (led by France Renouvelables) and CSIRT Automobile for the automotive sector (led by UTAC). Four existing structures in parallel receive reinforced capacity in the health, air transport, higher education and maritime transport sectors.
These structures are sectoral, not regional. Their scope is defined by the sector and the NIS2 entities that belong to it, wherever they are located in France. CERT Chimie is meant to handle incidents reported by all essential and important entities under the directive in the chemical sector, including subsidiaries of international groups based in the country.
What NIS2 already requires, and what sector CSIRTs make concrete
Article 10 of the NIS2 directive requires the entities concerned to notify their national CSIRT or competent authority within strict deadlines: an initial alert within 24 hours and a full notification within 72 hours. In France, ANSSI (via the CERT-FR) is the main recipient of these notifications. Until now, the CERT-FR has remained the only point of contact for most sectors, which made the relationship distant for mid-sized entities without a dedicated security team.
The sector CSIRTs created by the AMI SEC do not replace this obligation. They complement it: their mission includes incident assistance, proactive sharing of information on threats specific to the sector, and coordination of the response among entities in the same sector. For entities without an internal SOC, this structure becomes their first operational contact in the event of an incident. The NIS2 24-hour notification describes an administrative obligation. Sector assistance describes a response capability. The two add up, and the second presupposes that your organisation knows whom to turn to before an incident.
The context justifies this structuring: 99 data breaches have been brought to the attention of ANSSI since 1 August 2026, of which 67 are confirmed and 32 are being processed (source: ANSSI, situation report, 30 September 2026). This volume shows that national incident handling capacity for NIS2 must be distributed, not concentrated in a single central body.
The concrete case of the chemical industry
CERT Chimie, led by the Lyon Chamber of Commerce and Industry, illustrates why sectoral organisation makes sense. The chemical sector presents a combination of risks that is quite unusual: continuous industrial processes whose interruption creates physical risks, heavy dependence on programmable logic controllers and control systems (OT), and strategically sensitive data on formulations. A cybersecurity incident in this sector does not look like a messaging outage at a consulting firm.
General-purpose CSIRTs do not have indicators of compromise specific to chemical OT systems. CERT Chimie can develop alert signatures calibrated to the sector's technology base, distribute relevant indicators to its members and coordinate a response that takes into account real operational constraints. For NIS2 entities in the sector, this changes the concrete content of "appropriate measures" within the meaning of Article 21 of the directive.
What your NIS2 teams must do now
If your organisation belongs to one of the eight sectors covered (health, air transport, higher education and research, maritime transport, digital infrastructure, chemical industry, energy, automotive), three actions are expected before these CSIRTs are fully operational.
The first is to identify your sector CSIRT. The list of funded structures is published by ANSSI. Check which one matches your NAF code and obtain the membership or registration terms. These structures are starting their activities within weeks of the results being published: integration timelines are short.
The second is to update your incident response plan. If your current procedure only mentions the CERT-FR as a point of contact, add your sector CSIRT. Notification to ANSSI remains mandatory. The articulation with the sector CSIRT must be defined in advance, before any active incident.
The third is to subscribe to your CSIRT's information sharing feeds. NIS2 does not make participation in peer exchange structures mandatory, but your supervisory authorities will observe whether your teams use the available channels. A NIS2 programme that ignores the indicators of compromise distributed by an active sector CSIRT will struggle to justify that its measures are "appropriate to the state of the threat".
And for entities outside the covered sectors
The AMI SEC covers eight sectors. NIS2 entities in the banking, financial markets, drinking water or road network sectors do not yet have a dedicated sector CSIRT funded under this framework. For them, the CERT-FR remains the main point of contact. Some already have earlier sector structures (FSIE in telecoms, for example).
The momentum created by the AMI SEC should generate equivalents in other sectors. The growing European sectoral cooperation, documented in the analysis NIS2 cooperation: 14 incidents notified out of 322 detected, shows that the shortfall in incident reporting is not specific to France. Sectoral structuring is the logical response to this problem, and the AMI SEC is its national starting point.
What this programme changes for evidence of compliance
Demonstrating that your security measures are "appropriate" within the meaning of NIS2 Article 21 has largely relied on general frameworks (ISO 27001, ReCyF) and internal audits. The existence of a sector CSIRT adds an indirect layer of external verification: if your sector circulates alerts about an active threat and your organisation is unaware of them at the time of an inspection, the argument "we did not know" becomes hard to sustain.
This is not a direct sanction. It is a change in the level of vigilance expected by default. For a NIS2 programme under construction, integrating sector feeds is a priority to be included in the action plan before the end of the fourth quarter of 2026.